Pau Oliva poliva

## introspection-query.graphql

  query IntrospectionQuery {
    __schema {
      queryType { name }
      mutationType { name }
      subscriptionType { name }
      types {
        ...FullType
      }
      directives {

## all_tz_functions.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                Fuzion24
                / all_tz_functions.md
            
            
              Created
              September 16, 2015 14:30
            
          
    LOAD:FE82CDA8                 DCD aTzbsp_pil_init     ; "tzbsp_pil_init_image_ns"
LOAD:FE82CDAC                 DCD 0x3D
LOAD:FE82CDB0                 DCD tzbsp_pil_init_image_ns+1
LOAD:FE82CDB4                 DCD 2
LOAD:FE82CDB8                 DCD 4
LOAD:FE82CDBC                 DCD 4
LOAD:FE82CDC0                 DCD 0x805
LOAD:FE82CDC4                 DCD aTzbsp_pil_auth     ; "tzbsp_pil_auth_reset_ns"
LOAD:FE82CDC8                 DCD 0x3D


## android-tcpdump.sh
 #!/usr/bin/env bash

TCPDUMP_PID=""
SOCAT_PID=""
OUTPUT_FILE=""
PORT=12345
TMPDIR="."
TCPDUMP_PATH="/data/local/tmp/xbin/tcpdump"
NETCAT_PATH="/data/local/tmp/nc"
HOST_INTERFACE="en0"

## How to exploit msm_acdb
* 本来の流れ
  do_vfs_ioctlはacdb_ioctlをコールし、(1)のコードでリターンする。

	do_vfs_ioctl:
		STMPW   [SP], { R4-R9, LR }
		...
		BL      acdb_ioctl
		...
		ADD     SP, SP, #$44		// (2)
		LDMUW   [SP], { R4-R9, PC }	// (1)

## punch.py
#!/usr/bin/env python
#
# Proof of Concept: UDP Hole Punching
# Two client connect to a server and get redirected to each other.
#
# This is the client.
#
# Koen Bollen <meneer koenbollen nl>
# 2010 GPL
#

	query IntrospectionQuery {
	__schema {
	queryType { name }
	mutationType { name }
	subscriptionType { name }
	types {
	...FullType
	}
	directives {
	#!/usr/bin/env bash

	TCPDUMP_PID=""
	SOCAT_PID=""
	OUTPUT_FILE=""
	PORT=12345
	TMPDIR="."
	TCPDUMP_PATH="/data/local/tmp/xbin/tcpdump"
	NETCAT_PATH="/data/local/tmp/nc"
	HOST_INTERFACE="en0"
	* 本来の流れ
	do_vfs_ioctlはacdb_ioctlをコールし、(1)のコードでリターンする。

	do_vfs_ioctl:
	STMPW [SP], { R4-R9, LR }
	...
	BL acdb_ioctl
	...
	ADD SP, SP, #$44 // (2)
	LDMUW [SP], { R4-R9, PC } // (1)
	#!/usr/bin/env python
	#
	# Proof of Concept: UDP Hole Punching
	# Two client connect to a server and get redirected to each other.
	#
	# This is the client.
	#
	# Koen Bollen <meneer koenbollen nl>
	# 2010 GPL
	#